Compare & Contrast Two State Government IT Security...

Running head: COMPARE & CONTRAST 1
Compare & Contrast Two State Government IT Security Policies
December 4, 2016

Running Head: COMPARE & CONTRAST 2
Introduction
For some government agencies it can be confusing for who is responsible for protecting
that organizations information. The answer can be surprising, not only are the employees and
departments of a state government responsible for the protection of confidential information, the
state’s top executives are also responsible for the safekeeping for all of the state’s data. To
ensure protection of the state’s sensitive information the executive branch needs to confirm that
an effective IT security policy is in place, reviewed, and updated on a regular basis. The top of
the executive branch for state government is the governor, who should delegate the responsibility
to the state Chief Information Officer (CIO) that an appropriate IT security policy has been
authored. The CIO may pass this obligation onto the state’s Chief Information Security Officer
who would have more knowledge of what information the state’s IT security policy should
contain. The state CIO and CISO roles has been evolving over the last several years where a
close partnership between the two roles is critical to be able to manage an effective cybersecurity
program that protects state government assets and information. (Lohrmann, 2014) The main
purpose of an information security policy is to provide a well-documented strategy on how to
properly protect and maintain the confidentiality, availability and integrity to the state
government’s networks and resources. The information security policy should highlight such
areas as risk assessments, user responsibilities, password policies, disaster recovery,
administrative responsibilities, etc. (Bowden, 2003) It is essential every state maintains a
comprehensive information security policy. A well-written security policy is critical in ensuring
the protection of confidential state data, no matter if a more populous state with more funding or
a smaller state with less capital to invest into cybersecurity. Each state government’s information
security policy should reflect the most beneficial way to utilize what cybersecurity resources are

Running Head: COMPARE & CONTRAST 3
available in that state. Some states may include National Guard units specializing in cyber